CVE-2014-3936: D-Link HNAP CGI stack buffer overflow in do_hnap

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

critical priorityUnauthenticated remote code execution with a CVSS 2.0 base score of 10 and public exploit references, though the affected devices are older and may be less common.

What it is

A stack-based buffer overflow exists in the do_hnap function of www/my_cgi.cgi on D-Link DSP-W215 (Rev. A1) firmware 1.01b06 and earlier, DIR-505 firmware before 1.08b10, and DIR-505L firmware 1.01 and earlier. A long Content-Length header in a GetDeviceSettings HNAP request overflows the stack, allowing remote code execution. The flaw is remotely reachable and unauthenticated, making it serious for exposed devices.

Impact

An attacker can execute arbitrary code on the device, gaining full control of confidentiality, integrity and availability as reflected by the CVSS 2.0 score of 10. This can lead to device takeover and use as a foothold on the network.

Attack surface

Reachable over the network via an HNAP request to the device's CGI handler; the vector AV:N/AC:L/Au:N indicates no authentication and no user interaction are required. The attacker only needs to send a crafted GetDeviceSettings action with an oversized Content-Length header.

Exploitation

Not listed in CISA KEV, but EPSS is very high at 0.766 (99.5th percentile) and multiple references are tagged Exploit, including public write-ups and Packet Storm. This indicates public exploit code and active interest, though no confirmed in-the-wild campaign is stated in the record.

What to do

• Apply the vendor firmware updates referenced in D-Link advisories SAP10027 and SAP10029 (DIR-505 to 1.08b10 or later; check D-Link for DSP-W215 and DIR-505L fixes).
• If patching is not possible, remove or isolate affected devices from untrusted networks and disable remote/WAN management.
• Restrict access to the device web/HNAP interface to trusted management networks only.
• Replace end-of-life devices that no longer receive firmware updates.
• Monitor vendor advisories for updated firmware for the DSP-W215 and DIR-505L models.

Detection

• Inspect HTTP requests to the device CGI for HNAP GetDeviceSettings actions with abnormally large Content-Length values.
• Monitor device logs or network traffic for crashes, reboots or unexpected process restarts on affected D-Link models.
• Alert on outbound connections from these devices to unknown hosts, which may indicate post-exploitation.
• Use network segmentation monitoring to flag management-interface access from unexpected source addresses.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.